Creating A Self-Signed Oracle Wallet With orapki

Holy moly. Talk about the snake eating it's own tail.

Long story short: six years after developing a login module for Department of Defense Common Access Cards and an Oracle Forms application I was recently asked to do the same thing but on an Oracle 11g application server versus the Oracle 10g application server. Of course the Oracle 11g Middleware stack is almost completely different from the 10g version, but I still need an Oracle Wallet with a self-signed certificate. Six years is a long time to remember something like this but thanks to Google to answer was only a "Oracle Wallet self-signed certificate" search away.

And I found this: Oracle Wallet w/ Self-Signed Certificate on Tyler Muth's blog where a how-to I wrote six years ago on a now-defunct blog was re-posted. Thankfully Tyler re-posted the all of the steps and the links.

My method used OpenSSL to generate a trusted CA cert to sign a request generated by an Oracle Wallet and then importing the ca cert and the signed cert into the wallet. So, I downloaded cygwin, OpenSSL, the OpenSSL scripts and then I looked in the comments on Tyler's post and found another solution (thanks Frank!) using the orapki utility. This looked a lot easier, and it was, after I figured out how to translate it from 'nix to Windows-speak.

So here it is, how to use the orapki utility to create a wallet with a self-signed certificate on a Windows box:

1. orapki wallet create -wallet wallet_location -auto_login -pwd wallet_password
2. orapki wallet add -wallet wallet_location -dn “cn=server_hostname,cn=foo,dc=bar,dc=com” -keysize 1024 -self_signed -validity 3650 -pwd wallet_password

Notes:

• wallet_location is the directory the new wallet will be located in, not the wallet's filenname (Oracle likes its wallets to be named "ewallet.p12." Usually easier to leave it that way.)
• wallet_password is the wallet password. You specify it in the first step and will then use whenever you do soemething to the wallet, like add a certificate, using orapki or the Oracle Wallet Manager. Keep it in a safe place - no way to get into the wallet if you forget it in the future.

Finally, thanks Tyler - how did we get things done before the Internet?

Forms, RADs and Common Access Cards - It Works

After three weeks of twelve hour days, lost weekends, and two trips to our customer's location, we finally have an Oracle Forms application that can be accessed with Department of Defense Common Access Cards (CACs).

CACs are smart cards containing a PKI certificate. The military uses these for ID cards and for gaining access to the .mil domain. Users have to insert their CAC into a reader at a workstation to login to their local network.

We built a login module using two java servlets and a simple html form to read the users common name attribute from the card's distinguished name. The CAC's common name contains a unique identifier that is used to create an entry in Oracle Internet Directory. We use Oracle's sample forms_rad pl/sql package to create a Resource Access Descriptor for the user and store it in OID as well. After the user's OID entry and RAD are created, they are turned over to Forms, which is configured for Single Sign-On. Single Sign-on authenticates the user and Forms then pulls the RAD from OID and connects to their backend database account.

Although it was often frustrating, it was a great learning experience. My next project is to convert the servlets into .jsp pages. Now that we've got the configuration licked (about 75% of the effort was getting the Oracle Application Server 10g (10.1.2) configured correctly) this should be fairly simple.

Several folks posted helpful suggestions to previous entries in this blog and once again I'll say thanks to all for your help. If anyone has any questions about our configuration please post them here and I'll do my best to answer your questions.